Method and system for preventing dns cache poisoning

Abstract

A method for preventing the poisoning of at least one DNS cache ( 5 — i ) within a computer network (B) including several DNS caches ( 5 — 1, 5 — i, 5 — n ), this method comprising a step of comparing at least two DNS responses to a DNS query, returned by two different DNS caches.

1 . A method for preventing a poisoning of at least one DNS cache within a computer network including several DNS caches, the method comprising the steps of:
 comparing at least two DNS responses to a DNS query returned by two different DNS caches, and   analyzing the DNS query to identify a service with which said DNS query is associated before querying the DNS caches.   
     
     
         2 . The method according to  claim 1 , wherein a number of DNS caches queried depends upon the service with which the DNS query is associated. 
     
     
         3 . The method according to  claim 1 , wherein the step of comparing the at least two DNS responses further comprises a step of reversing a resolution of the DNS query by at least one DNS cache. 
     
     
         4 . The method according to  claim 1 , wherein the step of comparing the at least two DNS responses further comprises a step of calculating ratios of the at least two DNS responses. 
     
     
         5 . The method according to  claim 4 , wherein the DNS response with the highest ratio among a set of DNS responses returned by the DNS caches is the DNS response to the DNS query. 
     
     
         6 . The method according to  claim 1 , wherein an inconsistency among the at least two DNS responses returned by the DNS caches triggers at least one of the following actions:
 notifying a source of the DNS query of a security problem;   notifying a administrator of a computer network of a potential poisoning attack on at least one DNS cache;   storing at least one of the at least two DNS responses in a database.   
     
     
         7 . The method according to  claim 4 , wherein a Time To Live of a DNS cache returning a DNS response with a low ratio among the responses returned by the set of DNS caches is reduced to zero. 
     
     
         8 . The method according to  claim 1 , wherein the at least two DNS responses comprise a DNS response returned by a DNS root server. 
     
     
         9 . A system for preventing a poisoning of at least one DNS cache in a computer network including several DNS caches, the system comprising:
 an analyzer of at least two DNS responses to a DNS query returned by two different DNS caches, and   a DNS query analyzer, equipped with a database of information on DNS queries, configured to identify a service associated with the DNS query.   
     
     
         10 . The system according to  claim 9 , wherein the at least two DNS responses comprise a DNS response returned by a DNS root server.